CVE-2026-39552: WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability

Synopsis

A Local File Inclusion (LFI) vulnerability exists in the Blueprint WordPress theme by Code Supply Co., affecting all versions before 1.1.5. The flaw is reachable over the network without any authentication, though exploitation requires overcoming certain environmental conditions, reflecting a High CVSS score of 8.1. A successful attacker can read sensitive files from the server, tamper with data, and potentially crash or fully compromise the affected host. A patched-image rebuild at version 1.1.5 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress service via HTTP/HTTPS to attempt exploitation.

• AuthenticationNot required

  No account or session credential is needed; the vulnerable include path can be triggered by an unauthenticated HTTP request.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the request is sent directly to the server without any user action.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must account for specific environmental conditions or configurations, such as particular server path layouts or PHP settings, before the file inclusion succeeds reliably.

Blast Radius

• A successful attacker can read arbitrary files on the server, including WordPress configuration files that contain database credentials and secret keys.
• The attacker can include and execute PHP code already present on the filesystem, leading to full remote code execution on the host.
• Database contents, user records, and stored session tokens become readable or modifiable once database credentials are exposed.
• Malicious execution on the server can crash PHP worker processes or exhaust system resources, disrupting service availability.